Cookies and Sessions

Introduction#

A typical HTTP request-response cycle is stateless because servers consider each incoming request to be a brand new one. The primary reason for this kind of behavior is to enable the server-side to service many incoming requests and increase scalability as a result. Many use cases need the server-side to remember what the client has done before—meaning some state is required for each client. For example, if a customer wants to reserve an airplane ticket, they have to go through several steps involved in this process. This process requires many pages to be accessed, and the user’s state (information) must be kept across all the pages. Cookies and sessions are the two ways to maintain the user’s state and improve the user’s experience. Let's discuss them in detail in the following sections.

Cookies#

A cookie is a small amount of data stored by a specific website (server) on the user's computer. The data stored in the cookies is labeled with a unique ID. It’s exchanged between a client's browser and the server, where the server reads the cookies and decides what information needs to be provided to the user.

Cookies contain information about the user's activity on the website. This includes the user's IP address, web browser type, version, operating system, and the pages the user has visited. Some other relevant information stored in a cookie includes clicks on different items or objects and the actions performed by the client—for example, views, time spent, items added to a cart, and so on.

When a user sends a request to a web server to visit a website, a response from the server contains the Set-Cookie header representing details about the cookies, as shown below. The client sends this cookie in response to future requests to the web server.

How are cookies created?#

Let's understand cookie creation with an example. Let’s assume that Alice connects with the web using a newly installed browser and contacts the website www.example.com. When they visit the website for the first time, the server sends cookie data in response to Alice’s browser consisting of the unique ID. The cookies are stored locally and are sent in the requests to the same website, as shown in the figure below.

Note: A browser usually has an upper limit on the number of cookies that it can store per domain. For example, few browsers allow storing up to 50 cookies per domain, and the amount of information a server sends to the client is small (usually no more than 4 KB).

The following table shows different attributes of a cookie object while visiting www.google.com.

Note: In the table above, the tick (✓) symbol means the values have been provided. Whereas "–" means the values have not been provided.

Note: Although cookies do not change the behavior of HTTP in any way, they do function as application-specific data storage that help maintain the state within an application according to different users.

What are cookies used for?#

• Session management: Cookies can be used for session management. Upon exchanging cookies, the website recognizes users and their preferences. For example, whether  a specific user likes to see news related to sports or politics.

• Personalization: Cookies help the server-side maintain client-specific information. This helps in providing an experience that has been tailor-made for a particular user.

• Tracking: Cookies are used to track users across websites. For example, when a user visits a website, a cookie is stored on their computer. The cookie contains information about the user, such as the pages they visited, the time they visited, and the time they spent on a specific page. This allows businesses to show targeted ads to users based on their interests. Cookies can also be used to track users' browsing history and activity. This information can be used to personalize the user's experience on a website or application.

Note: Cookies can be deleted in your browser settings. You can find the settings in the “Options” or “Preferences” menu of your browser.

Sessions#

Sessions refer to the time users spend browsing a website. It represents the time between the user's arrival on a website's page and when they finish surfing it. A web session is a series of network activities that takes place between a web server and a web browser. During a session, the server and browser exchange a series of messages and information to establish a connection and start interacting with each other.

The interaction and the data exchanged between a web server and a web browser can include our search engine history, form data, added items to a shopping cart, ticket booking, the amount of time consumed on a page of a website, and so on. This data is exchanged via different kinds of cookies between the web server and the browser. To sum up, any interaction that we have with any website is recorded as a web session.

While sessions are often conflated and confused with cookies, they have some key differences from each other, as shown in the following table.

A single session between a web browser and the web server lasts for a certain duration. Depending on the use case, this session can be as short as a few minutes or as long as an entire day (or more).

Why is a web session used?#

Instead of storing a huge amount of data in the browser, developers use session IDs to save information on the server-side while preserving user privacy. Both sessions and cookies have unique IDs; therefore, a web application sends the session ID and cookie ID back to the server each time a user performs an action or submits a request, along with a description of the activity.

Note: Session IDs and cookie IDs are sometimes confused. They both are closely related but aren’t the same. Cookie IDs identify a specific computer or visitor and can be used for authentication, storing website preferences and server session identification. On the other hand, session IDs are used to identify a specific session. A client has only one cookie ID but may have several session IDs, these two can be used together to better track the preferences of the user and give them a better experience.

A session's role in APIs#

As discussed earlier, a session is a stateful connection between a client and a server. In the context of APIs, a session is typically used to store information about the state of a user's interaction with an API, such as authentication details, preferences, and progress. This information can then be used to customize the API experience for the user and provide a more seamless interaction.

Note: There’s plenty more stuff about cookies that we can talk about, but for the purpose of this course, this information will suffice. To conclude, cookies either benefit businesses or evade privacy. Therefore, some organizations support cookies while others oppose them. For example, Apple and Google clamped down on cookies (especially those that help track user activity), which hurt many advertisement businesses for big tech giants like Meta. On the other hand, Amazon supports and uses cookies for various purposes.

Summary#

To provide a better user experience in a number of applications, cookies play a vital role in exchanging crucial data between a client and a server. Cookies are also used to establish sessions on the server side. Web sessions are important because they allow website owners to track what users do on their websites. This information can be used to improve the user experience by making changes to the website based on how users interact with it. Additionally, web sessions can be used to track user behavior for marketing or advertising purposes.